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Method and System for Providing Access via a First Network to a Service of 

a Second Network 

FIELD OF THE INVENTION 

The present invention relates to a method and system for providing access via a 
5 first network, for example a Wireless Local Area Network (WLAN), to a service of a 
second network, for example a service subscribed to in a Genera! Packet Radio 
Service (GPRS) network or a Universal Mobile Telecommunications System 
(UMTS) network. 

BACKGROUND OF THE INVENTION 

10 Over recent years, the market for wireless communications has enjoyed tremen- 
dous growth. Wireless technology now reaches or is capable of reaching virtually 
every location on the earth. With tremendous success of wireless telephony and 
messaging services, it is hardly surprising that wireless communication is begin- 
ning to be applied to the realm of personal and business computing. No longer 

15 bound by the harnesses of wired networks, people will be able to access and 
share information on a global scale nearly anywhere they venture. 

The major motivation and benefit from WLANs is increased mobility. Network us- 
ers can move about almost without restriction and access LANs from nearly eve- 
rywhere. In addition to increased mobility, WLANs offer increased flexibility. Meet- 
20 ings can be arranged, jn which employees use small computers and wireless links 
to share and discuss future design plans and products. Such "ad hoc" networks 
can be brought up and torn down in a very short time as needed, either around the 
conference table and/or around the world. WLANs offer the connectivity and the 
convenience of wired LANs without the need for expensive wiring or re-wiring. 

25 However, even with the fastest laptop, productivity while travelling can fall because 
of poor access to the Internet or company intranet. Despite the revolution of the 
Global System for Mobile communication (GSM), laptop users need faster access 
to download large files and to synchronize their e-mails quickly. The emerging 
mobile information society demands that data is available whenever and wherever. 

30 As a solution to this problem an operator WLAN solution has been proposed which 
brings broadband access to the laptop or terminal device in specific places like 
airports, convention centers, hotels and meeting rooms. Thus, mobile network op- 
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erators are able to offer broadband access to the internet, corporate intranets or 
other service machineries from virtually anywhere in the world. Thus, a public 
WLAN service with own WLAN roaming feature can be provided. 

In packet-switched cellular networks, such as the GPRS or UMTS network, the 
5 users service descriptions are specified by Access Point Names (APN). GPRS is a 
common packet domain core network used for both GSM and UMTS networks. 
This common core network provides packet-switched services and is designed to 
support several quality of service levels in order to allow efficient transfer of non 
real-time traffic and real-time traffic. The Serving GPRS Support Node (SGSN) 

1 0 keeps track of the individual location of a mobile terminal and performs security 
functions and access control. The Gateway GPRS Support Node (GGSN) pro- 
vides interworking with external packet-switched networks, and is connected with 
SGSNs via an IP-based packet domain backbone network. In the. backbone net- 
work, the APN is in practice a reference to the GGSN to be used. In addition, the 

15 APN may, in the GGSN, identify the external network and optionally a service to 
be offered. Further details concerning the use and structure of APNs are defined 
e.g. in the 3GPP specification TS 23.003. 

When a user connects to a GPRS service, i.e. establishes a Packet Data Protocol 
(PDP) context as specified e.g. in the 3GPP specifications TS 23.060, the APN 

20 information selected by the terminal device or user equipment (UE) or the user of 
the terminal device is sent from the terminal device to the network in a PDP con- 
text establishment signaling. This information consists of APN and optionally user- 
name and password if required to access the service behind the selected APN. In 
the GPRS network, this information is used to select suitable GGSN. The informa- 

25 tion also arrives to the selected GGSN and the GGSN uses this information fur- 
ther to establish a connection to a network node behind the GGSN, e.g. a corpo- 
rate intranet or an operator service node. If provided, the username and password 
are delivered to the concerned network node behind the GGSN to allow authoriza- 
tion of the connection. 



30 However, in the proposed public or operator WLAN systems, an operation similar 
to the GPRS PDP context activation is not provided. In particular, there is no dedi- 
cated signaling for setting up services between a WLAN terminal device, i.e. 
WLAN UE, and the WLAN network or network behind the WLAN network. There- 
fore, GPRS type of service selection and activation is not possible via the WLAN 

35 network, which thus forms a drawback in the proposed public or operator WLANs. 
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SUMMARY OF THE INVENTION 

It is therefore an object of the present invention to provide a method and system 
for providing access from a WLAN network or any other first network to a service 
provided by a GPRS or any other second network. 

5 This object is achieved by a method of providing access via a first network to a 
service facilitated by a second network, the method comprising the steps of: 

- using an authentication message to signal a service selection information via 
said first network to an authentication server means of said second network; and 

- using said service selection information to connect to services provided over an 
10 access point indicated by said service selection information. 

Furthermore, the above object is achieved by an authentication server device for 
providing an authentication mechanism, said authentication being arranged: 

- to extract from a received authentication message a service selection information 
1 5 for selecting a service; and 

- to use said service selection information for establishing a connection to services 
provided over an access point indicated by said service selection information. 

Additionally, the above object is achieved by a terminal device for providing ac- 
20 cess to a network service, said device being arranged to set in an authentication 
message a service selection information for selecting said network service. 

. Accordingly, a service selection information or service description is forwarded to 
the second network by using an authentication signaling between the terminal de- 
vice and an authentication server of the second network, which then uses the ser- 

25 vice selection information to establish a connection to the desired or subscribed 
service. Thereby, access to network services of third parties is possible over the 
first network, e.g. the WLAN. Thus, dynamic service selection and multiple simul- 
taneous connections to different services are enabled, and service continuity is 
obtained between different networks, such as WLANs and cellular packet-switched 

30 networks. Thereby, network flexibility and user mobility can be enhanced and ser- 
vice logics can be unified in different networks. 

From the network operator's point of view, the proposed solution is advantageous 
in that current service description mechanisms, such as the APN mechanism in 
GPRS, can be used in new operator WLANs to thereby support legacy solutions. 
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The authentication message may be a message of the Extensible Authentication 
Protocol (EAP). In particular, the authentication message may be an EAP re- 
sponse message. 

5 The service selection information may comprise at least one APN parameter. This 
at least one APN parameter may comprise an APN, a username and a password 
of the desired service. Furthermore, the APN parameter may be encrypted in the 
authentication message. The applied encryption for different APN parameters 
may be selected differently, so that selected APN parameters may be forwarded 
10 by the authentication server to the selected access point in encrypted format, and 
that the selected APN parameters are decrypted only at the access point or se- 
lected service network. 

BRIEF DESCRIPTION OF THE DRAWINGS 

In the following, the invention will be described in greater detail based on a pre- 
1 5 ferred embodiment with reference to the accompanying drawings, in which: 

Fig. 1 shows a schematic block diagram indicating the basic principles underlying 
the present invention; 

Fig. 2 shows a schematic block diagram of a WLAN connected via a WLAN gate- 
way of a GPRS network to an application server; 



20 Fig. 3 shows an EAP signaling according the preferred embodiment of the present 
invention; and 

Fig. 4 shows the format of an enhanced EAP Response Challenge packet accord- 
ing to the preferred embodiment. 

DESCRIPTION OF THE PREFERRED EMBODIMENT 

25 The preferred embodiment will now be described on the basis of a network archi- 
tecture as indicated in Figs. 1 and 2, where a WLAN user is authenticated to ac- 
cess a WLAN network by an EAP authentication to thereby get access to a cellular 
packet-switched service. 
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Fig. 1 shows a schematic block diagram of a network architecture comprising a 
WLAN 30 and a GPRS network 70. A terminal device or UE 10 which is sub- 
scribed to a GPRS service and wishes to get access to the service, first transfers a 
service selection information indicating at least one APN parameter and an op- 
5 tional username and password via the WLAN 30 to an authentication server 50 of 
the GPRS network 70 by using an authentication signaling, e.g. an authorisation 
request message (1 st step). Then, the authentication server 50 selects a WLAN 
gateway 60 arranged in the GPRS network 70, signals the service information to 
the WLAN gateway 60, and as a response receives from the WLAN gateway 60 a 

1 0 connection information for establishing a connection between an access server 40 
of the WLAN 30 and an application server 80 providing the requested service and 
being identified by the at least one APN parameter (2 nd step). In particular, the au- 
thorisation request may be forwarded further to the application server 80 or an- 
other external AAA server together with the username and password and the 

1 5 WLAN gateway 60 first receives a response from there and then proxies this re- 
sponse to the access server 40. 

Fig. 2 shows a more detailed block diagram of a network architecture in which the 
preferred embodiment of the present invention can be implemented. In Fig. 2, a 
WLAN UE 10 is connected via a wireless connection to an access point 20 of a 
20 WLAN 30. It is noted that the access point 20 has a similar functionality as a base 
station in a general cellular network. The access point 20 is not mobile and forms 
part of the wired network infrastructure. Further details regarding the architecture 
and function of the WLAN network 30 can be gathered e.g. from the IEEE specifi- 
cation 802.1 1. 

25 Furthermore, the WLAN 30 comprises a WLAN access server 40 for establishing a 
connection to external networks such as a GPRS network 70 or another packet- 
switched network 90, e.g. the Internet or an operator or company intranet. The 
GPRS network 70 comprises an authentication server 50, , with an allocated au- 
thentication server database 55 in which subscriber information such as service 

30 profile information of each connected terminal device or UE are stored after re- 
trieval of that information from a permanent subscriber database 1 10 at sub- 
scriber's home network 110. It is noted that the the functionality of the authentica- 
tion server 50 can also be located at users home network or a WLAN backbone or 
subsystem. The authentication signaling with the UE 10 may be based on the 

35 EAP SIM authentication protocol in case a GSM SIM card is used within the UE 
10. Alternatively, the authentication may be based on the EAP AKA (Authentica- 
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tion and Key Agreement) authentication protocol in case a UMTS SIM card is used 
within the UE 10. 

The EAP protocol mechanism is used for authentication and session key distribu- 
tion by means of the GSM SIM or the USIM. Authentication is based on a chal- 
5 lenge-response mechanism, wherein the authentication algorithm which runs on 
the SIM or USIM card can be given a random number (RAND) as a challenge. The 
SIM or USIM runs an operator-specific confidential algorithm which takes the 
RAND and a secret key stored on the SIM or USIM as input, and produces a re- 
sponse (SRES) and a key as output. The key is originally intended to be used as 

1 0 an encryption key over the air interface. The authentication server 50 has an inter- 
face to the GSM or UMTS home network 100 of the UE 10 and operates as a 
gateway between the packet-switched AAA (Authentication, Authorization and Ac- 
counting) networks and the GSM or UMTS authentication infrastructure. After re- 
ceiving an EAP identity response including user identification mappable to the 

1 5 user's International Mobile Subscriber Identity (IMSI) the authorization server 50 
obtains n triplets or quintuplets from the authentication center at the home location 
register (HLR) or Home Subscriber Server (HSS) 1 10 of the user's home network 
100. From the triplets, the authentication server 50 derives the keying material 
based on a cryptographic algorithm. 

20 According to the preferred embodiment, the WLAN authentication signaling is 
used for signaling GPRS service subscription or selection information via the au- 
thentication server 50 to the GPRS network 70. The GPRS service information or 
service selection information comprises the APN of the. desired service and an 
optional username and password required to connect to the service via the indi- 

25 cated APN. The authentication server 50 uses the obtained service selection in- 
formation to select the WLAN gateway 60 having a similar function to a GGSN, 
from where the user can get access to the subscribed service. The subscribed 
service can be e.g. an access to a corporate intranet or to services of a mobile 
operator. 

30 Fig. 3 shows a signaling diagram indicating an EAP-SIM authentication signaling 
between the UE 10 and the authentication server 50 of the GPRS network 70. The 
first EAP request (not shown) issued by the network is an EAP Identity Request. 
The client or UE 10 responds with an EAP Identity Response (step 1) comprising a 
pseudonym or IMSI. The pseudonym is used when an identity privacy support is 

35 being used by the UE 10. In response to the EAP Identity Response message or 
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packet, the authentication server 50 sends an EAP challenge request comprising 
the n random numbers RAND among other parameters (step 2). In response 
thereto, the UE 10 issues an EAP Challenge Response including the calculated 
response value SRES. Furthermore, according to the preferred embodiment of the 
5 present invention, the EAP Challenge Response also includes at least one en- 
crypted APN parameter specifying the desired GPRS service to be accessed. The 
encrypted APN parameters my comprise the APN of the desired service and an 
optional username and password for getting access to the service (step 3). The 
applied encryption for different APN parameters may be selected differently. I.e., 

1 0 the APN itself may be the only APN parameter which is required for AP selection, 
and therefore only this parameter has to be in a format which is to be decrypted 
and/or read by the access server. The username and password parameters may 
be forwarded by the authentication server to the selected access point in en- 
crypted format, and these parameters are decrypted only at the access point or 

15 selected service network. It is thus not possible to access them while transferred 
via the first network. If the authentication procedure was successful, the authenti- 
cation server 50 responds with an EAP Success message (step 4). 

The above authentication signaling procedure enables a signaling of service selec- 
tion parameters to the authentication server 50 without requiring any additional 

20 context activation function as would be required in a conventional GPRS network 
without WLAN functionality. To achieve this enhanced functionality of the authenti- 
cation signaling, the client software at the UE 10 is modified or programmed to add 
the respective service selection information to the EAP Challenge Response mes- 
sage. In particular, if a user has selected to connect to a specific service identified 

25 by its APN, the service information or service selection information is configured in 
the client software at the UE 10. For each service the following settings may be 
performed. Firstly, a free text entry identifying the service for the user may be set. 
Secondly, the APN, i.e. the identification of the Public Land Mobile Network 
(PLMN) plus the Domain Name Server (DNS) name assigned by the Mobile Op- 

30 erator (MO) may be set to point to the specific service, and, thirdly, a setting indi- 
cating whether the username and password are required (e.g. a Yes/No setting) 
can be made in the client software. The third setting may comprise a setting indi- 
cating either a predefined or a dynamic username or/and password setting. 

At the latest after reception of the EAP request message, the UE 10 gets the re- 
35 quired service selection related information from the user and encrypts it as speci- 
fied by the utilised signalling protocol such as EAP-SIM. The UE 10 then inserts 
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the APN parameter information to the EAP Challenge Response message and 
sends it via the WLAN 30 to the authentication server 50. 

Fig. 4 shows a format of the enhanced EAP SIM Challenge Response message 
according to the preferred embodiment as generated at the SIM. A "code" field is 
5 used to identify the message as a response message. An "identifier" field is one 
octet and aids in matching replies to responses. In particular, the "identifier" field 
must match the "identifier" field of the message to which it is sent in response. The 
"length" field indicates the length of the EAP message or packet. The "type" and 
"sub-type" fields are set to specific values specifying the EAP SIM Challenge Re- 
10 sponse message. The "reserved" fields are set to zero upon sending and ignored 
on reception. The "AT_SRES" field indicates an attribute value and is followed by 
an additional "length" field indicating the length of the following SRES value and by 
a "reserved" field. Finally, the proposed APN parameters specifying the requested 
service may be added e.g. as encrypted values. 

15 It is noted that the present invention is not restricted to the described WLAN and 
GPRS service and can be used in any network architecture where a control plane 
signaling required for accessing a packet-switched service is not provided in the 
access network. The functionalities of the authentication server 50 and the gate- 
way 60 not necessarily have to be GPRS functionalities, but can be located in any 

20 backbone network or subsystem of the WLAN or any other network accessible by 
the WLAN 30. They may be provided in standalone server devices or in GPRS 
GGSN or SGSN functionalities, respectively. Also, the accessed service does not 
have to be a GPRS service. Thus, the WLAN UE 1 0 can be a single-mode WLAN 
terminal without GPRS functionality but with a functionality to access external ser- 

25 vices via an authentication signaling, e.g. by a similar mechanism as the GPRS 
service selection mechanism. Furthermore, any given authentication message can 
be used for transferring the service selection information. The preferred embodi- 
ments may thus vary within the scope of the attached claims. 



30 
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Claims 



1. 

5 
10 

2. 
3. 

15 4. 
5. 
6. 

20 

7. 
8. 

25 9. 



A method of providing access via a first network (30) to a service facilitated 
by a second network (90), said method comprising the steps of: 

a) using an authentication message to signal a service selection informa- 
tion via said first network to an authentication server means (50) of 
said second network (30); and 

b) using said service selection information to connect to services pro- 
vided over an access point indicated by said service selection informa- 
tion. 

A method according toclaim 1, wherein said first network is a wireless local 
area network (30). 

A method according to any one of the preceding claims, wherein said sec- 
ond network is a cellular packet-switched network (70). 

A method according to claim 3, wherein said cellular packet-switched net- 
work is a GPRS network (70). 

A method according to any one of the preceding claims, wherein said 
authentication message is an EAP message. 

A method according to claim 5, wherein said EAP message is an EAP SIM 
or EAP AKA message, 

A method according to claim 5 or 6, wherein said authentication message is 
an EAP Challenge Response message. 

A method according to any one of the preceding claims, wherein said 
service selection information comprises at least one APN parameter. 

A method according to claim 8, wherein said at least one APN parameter 
comprises an APN, a username and a password. 



10. 



A method according to claim 7 or 8, wherein said APN parameter is en- 
crypted in said authentication message. 
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ll . A method according to claim 9 or 10, wherein at least one of said APN pa- 
rameters is encrypted so that it can only be decrypted at the network de- 
fined by the APN) 

12. An authentication server device for providing an authentication mechanism, 
5 said authentication server (50) being arranged: 

a) to extract from a received authentication message a service selection 
information for selecting a service; and 

b) to use said service selection information for establishing a connection to 
services provided over an access point indicated by said service selec- 

10 tion information. 

13. An authentication server according to claim 12, wherein said authentication 
mechanism is based on an EAP protocol. 

14. An authentication server according to claim 13, wherein said received au- 
thentication message is an EAP Challenge Response message. 

15 15 An authentication server according to any one of claims 12 to 14, wherein 
said authentication server is a standalone WLAN authentication server (50). 

16. An authentication server according to any one of claims 12 to 14, wherein 
said authentication server is a GGSN. 

1 7. An authentication server device according to any one of claims 1 2 to 16, 
20 wherein said service selection information comprises at least one APN pa- 
rameter. 

18. An authentication server according to claim 17 , wherein said APN parame- 
ter is encrypted in said authentication message. 

19. An authentication server according to claim 17 or 18, wherein at least one 
25 of said APN parameters is decrypted in said authentication server. 



20. 



An authentication server according to claims 17 to 19 , wherein at least one 
of said APN parameter is forwarded by the authentication server to said ac- 
cess point in an encrypted manner. 
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21 . A terminal device for providing access to a network service, said device be- 
ing arranged to set in an authentication message a service selection infor- 
mation for selecting said network service. 

22. A device according to claim 21 , wherein said authentication message is an 
5 EAP message. 

23. A device according to claim 22, wherein said EAP message is an EAP 
Challenge Response message. 

24. A device according to claim 23, wherein said EAP Challenge Response 
message is an EAP SIM or EAP AKA Challenge Response message. 

10 25. A device according to any one of claims 21 to 24, wherein said service se- 
lection information comprises at least one APN parameter. 

26. A device according to any one of claims 21 to 25, wherein said service is a 
GPRS service. 

27. A system for providing access from a first network (30) to a service of a 

15 second network (90), said system comprising a terminal device according to 
any one of claims 21 to 26, said terminal device (10) being connected to 
said first network (30), and an authentication server device (40) according 
to any one of claims 14 to 20, said authentication server being connected to 
said second network ... 



20 
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